Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0
0002 #include <limits.h>
0003 #include <stddef.h>
0004 #include <stdbool.h>
0005 #include <string.h>
0006 #include <linux/pkt_cls.h>
0007 #include <linux/bpf.h>
0008 #include <linux/in.h>
0009 #include <linux/if_ether.h>
0010 #include <linux/icmp.h>
0011 #include <linux/ip.h>
0012 #include <linux/ipv6.h>
0013 #include <linux/tcp.h>
0014 #include <linux/udp.h>
0015 #include <linux/if_packet.h>
0016 #include <sys/socket.h>
0017 #include <linux/if_tunnel.h>
0018 #include <linux/mpls.h>
0019 #include <bpf/bpf_helpers.h>
0020 #include <bpf/bpf_endian.h>
0021 
0022 #define PROG(F) PROG_(F, _##F)
0023 #define PROG_(NUM, NAME) SEC("flow_dissector") int flow_dissector_##NUM
0024 
0025 /* These are the identifiers of the BPF programs that will be used in tail
0026  * calls. Name is limited to 16 characters, with the terminating character and
0027  * bpf_func_ above, we have only 6 to work with, anything after will be cropped.
0028  */
0029 #define IP      0
0030 #define IPV6        1
0031 #define IPV6OP      2 /* Destination/Hop-by-Hop Options IPv6 Ext. Header */
0032 #define IPV6FR      3 /* Fragmentation IPv6 Extension Header */
0033 #define MPLS        4
0034 #define VLAN        5
0035 #define MAX_PROG    6
0036 
0037 #define IP_MF       0x2000
0038 #define IP_OFFSET   0x1FFF
0039 #define IP6_MF      0x0001
0040 #define IP6_OFFSET  0xFFF8
0041 
0042 struct vlan_hdr {
0043     __be16 h_vlan_TCI;
0044     __be16 h_vlan_encapsulated_proto;
0045 };
0046 
0047 struct gre_hdr {
0048     __be16 flags;
0049     __be16 proto;
0050 };
0051 
0052 struct frag_hdr {
0053     __u8 nexthdr;
0054     __u8 reserved;
0055     __be16 frag_off;
0056     __be32 identification;
0057 };
0058 
0059 struct {
0060     __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
0061     __uint(max_entries, MAX_PROG);
0062     __uint(key_size, sizeof(__u32));
0063     __uint(value_size, sizeof(__u32));
0064 } jmp_table SEC(".maps");
0065 
0066 struct {
0067     __uint(type, BPF_MAP_TYPE_HASH);
0068     __uint(max_entries, 1024);
0069     __type(key, __u32);
0070     __type(value, struct bpf_flow_keys);
0071 } last_dissection SEC(".maps");
0072 
0073 static __always_inline int export_flow_keys(struct bpf_flow_keys *keys,
0074                         int ret)
0075 {
0076     __u32 key = (__u32)(keys->sport) << 16 | keys->dport;
0077     struct bpf_flow_keys val;
0078 
0079     memcpy(&val, keys, sizeof(val));
0080     bpf_map_update_elem(&last_dissection, &key, &val, BPF_ANY);
0081     return ret;
0082 }
0083 
0084 #define IPV6_FLOWLABEL_MASK     __bpf_constant_htonl(0x000FFFFF)
0085 static inline __be32 ip6_flowlabel(const struct ipv6hdr *hdr)
0086 {
0087     return *(__be32 *)hdr & IPV6_FLOWLABEL_MASK;
0088 }
0089 
0090 static __always_inline void *bpf_flow_dissect_get_header(struct __sk_buff *skb,
0091                              __u16 hdr_size,
0092                              void *buffer)
0093 {
0094     void *data_end = (void *)(long)skb->data_end;
0095     void *data = (void *)(long)skb->data;
0096     __u16 thoff = skb->flow_keys->thoff;
0097     __u8 *hdr;
0098 
0099     /* Verifies this variable offset does not overflow */
0100     if (thoff > (USHRT_MAX - hdr_size))
0101         return NULL;
0102 
0103     hdr = data + thoff;
0104     if (hdr + hdr_size <= data_end)
0105         return hdr;
0106 
0107     if (bpf_skb_load_bytes(skb, thoff, buffer, hdr_size))
0108         return NULL;
0109 
0110     return buffer;
0111 }
0112 
0113 /* Dispatches on ETHERTYPE */
0114 static __always_inline int parse_eth_proto(struct __sk_buff *skb, __be16 proto)
0115 {
0116     struct bpf_flow_keys *keys = skb->flow_keys;
0117 
0118     switch (proto) {
0119     case bpf_htons(ETH_P_IP):
0120         bpf_tail_call_static(skb, &jmp_table, IP);
0121         break;
0122     case bpf_htons(ETH_P_IPV6):
0123         bpf_tail_call_static(skb, &jmp_table, IPV6);
0124         break;
0125     case bpf_htons(ETH_P_MPLS_MC):
0126     case bpf_htons(ETH_P_MPLS_UC):
0127         bpf_tail_call_static(skb, &jmp_table, MPLS);
0128         break;
0129     case bpf_htons(ETH_P_8021Q):
0130     case bpf_htons(ETH_P_8021AD):
0131         bpf_tail_call_static(skb, &jmp_table, VLAN);
0132         break;
0133     default:
0134         /* Protocol not supported */
0135         return export_flow_keys(keys, BPF_DROP);
0136     }
0137 
0138     return export_flow_keys(keys, BPF_DROP);
0139 }
0140 
0141 SEC("flow_dissector")
0142 int _dissect(struct __sk_buff *skb)
0143 {
0144     struct bpf_flow_keys *keys = skb->flow_keys;
0145 
0146     return parse_eth_proto(skb, keys->n_proto);
0147 }
0148 
0149 /* Parses on IPPROTO_* */
0150 static __always_inline int parse_ip_proto(struct __sk_buff *skb, __u8 proto)
0151 {
0152     struct bpf_flow_keys *keys = skb->flow_keys;
0153     void *data_end = (void *)(long)skb->data_end;
0154     struct icmphdr *icmp, _icmp;
0155     struct gre_hdr *gre, _gre;
0156     struct ethhdr *eth, _eth;
0157     struct tcphdr *tcp, _tcp;
0158     struct udphdr *udp, _udp;
0159 
0160     switch (proto) {
0161     case IPPROTO_ICMP:
0162         icmp = bpf_flow_dissect_get_header(skb, sizeof(*icmp), &_icmp);
0163         if (!icmp)
0164             return export_flow_keys(keys, BPF_DROP);
0165         return export_flow_keys(keys, BPF_OK);
0166     case IPPROTO_IPIP:
0167         keys->is_encap = true;
0168         if (keys->flags & BPF_FLOW_DISSECTOR_F_STOP_AT_ENCAP)
0169             return export_flow_keys(keys, BPF_OK);
0170 
0171         return parse_eth_proto(skb, bpf_htons(ETH_P_IP));
0172     case IPPROTO_IPV6:
0173         keys->is_encap = true;
0174         if (keys->flags & BPF_FLOW_DISSECTOR_F_STOP_AT_ENCAP)
0175             return export_flow_keys(keys, BPF_OK);
0176 
0177         return parse_eth_proto(skb, bpf_htons(ETH_P_IPV6));
0178     case IPPROTO_GRE:
0179         gre = bpf_flow_dissect_get_header(skb, sizeof(*gre), &_gre);
0180         if (!gre)
0181             return export_flow_keys(keys, BPF_DROP);
0182 
0183         if (bpf_htons(gre->flags & GRE_VERSION))
0184             /* Only inspect standard GRE packets with version 0 */
0185             return export_flow_keys(keys, BPF_OK);
0186 
0187         keys->thoff += sizeof(*gre); /* Step over GRE Flags and Proto */
0188         if (GRE_IS_CSUM(gre->flags))
0189             keys->thoff += 4; /* Step over chksum and Padding */
0190         if (GRE_IS_KEY(gre->flags))
0191             keys->thoff += 4; /* Step over key */
0192         if (GRE_IS_SEQ(gre->flags))
0193             keys->thoff += 4; /* Step over sequence number */
0194 
0195         keys->is_encap = true;
0196         if (keys->flags & BPF_FLOW_DISSECTOR_F_STOP_AT_ENCAP)
0197             return export_flow_keys(keys, BPF_OK);
0198 
0199         if (gre->proto == bpf_htons(ETH_P_TEB)) {
0200             eth = bpf_flow_dissect_get_header(skb, sizeof(*eth),
0201                               &_eth);
0202             if (!eth)
0203                 return export_flow_keys(keys, BPF_DROP);
0204 
0205             keys->thoff += sizeof(*eth);
0206 
0207             return parse_eth_proto(skb, eth->h_proto);
0208         } else {
0209             return parse_eth_proto(skb, gre->proto);
0210         }
0211     case IPPROTO_TCP:
0212         tcp = bpf_flow_dissect_get_header(skb, sizeof(*tcp), &_tcp);
0213         if (!tcp)
0214             return export_flow_keys(keys, BPF_DROP);
0215 
0216         if (tcp->doff < 5)
0217             return export_flow_keys(keys, BPF_DROP);
0218 
0219         if ((__u8 *)tcp + (tcp->doff << 2) > data_end)
0220             return export_flow_keys(keys, BPF_DROP);
0221 
0222         keys->sport = tcp->source;
0223         keys->dport = tcp->dest;
0224         return export_flow_keys(keys, BPF_OK);
0225     case IPPROTO_UDP:
0226     case IPPROTO_UDPLITE:
0227         udp = bpf_flow_dissect_get_header(skb, sizeof(*udp), &_udp);
0228         if (!udp)
0229             return export_flow_keys(keys, BPF_DROP);
0230 
0231         keys->sport = udp->source;
0232         keys->dport = udp->dest;
0233         return export_flow_keys(keys, BPF_OK);
0234     default:
0235         return export_flow_keys(keys, BPF_DROP);
0236     }
0237 
0238     return export_flow_keys(keys, BPF_DROP);
0239 }
0240 
0241 static __always_inline int parse_ipv6_proto(struct __sk_buff *skb, __u8 nexthdr)
0242 {
0243     struct bpf_flow_keys *keys = skb->flow_keys;
0244 
0245     switch (nexthdr) {
0246     case IPPROTO_HOPOPTS:
0247     case IPPROTO_DSTOPTS:
0248         bpf_tail_call_static(skb, &jmp_table, IPV6OP);
0249         break;
0250     case IPPROTO_FRAGMENT:
0251         bpf_tail_call_static(skb, &jmp_table, IPV6FR);
0252         break;
0253     default:
0254         return parse_ip_proto(skb, nexthdr);
0255     }
0256 
0257     return export_flow_keys(keys, BPF_DROP);
0258 }
0259 
0260 PROG(IP)(struct __sk_buff *skb)
0261 {
0262     void *data_end = (void *)(long)skb->data_end;
0263     struct bpf_flow_keys *keys = skb->flow_keys;
0264     void *data = (void *)(long)skb->data;
0265     struct iphdr *iph, _iph;
0266     bool done = false;
0267 
0268     iph = bpf_flow_dissect_get_header(skb, sizeof(*iph), &_iph);
0269     if (!iph)
0270         return export_flow_keys(keys, BPF_DROP);
0271 
0272     /* IP header cannot be smaller than 20 bytes */
0273     if (iph->ihl < 5)
0274         return export_flow_keys(keys, BPF_DROP);
0275 
0276     keys->addr_proto = ETH_P_IP;
0277     keys->ipv4_src = iph->saddr;
0278     keys->ipv4_dst = iph->daddr;
0279     keys->ip_proto = iph->protocol;
0280 
0281     keys->thoff += iph->ihl << 2;
0282     if (data + keys->thoff > data_end)
0283         return export_flow_keys(keys, BPF_DROP);
0284 
0285     if (iph->frag_off & bpf_htons(IP_MF | IP_OFFSET)) {
0286         keys->is_frag = true;
0287         if (iph->frag_off & bpf_htons(IP_OFFSET)) {
0288             /* From second fragment on, packets do not have headers
0289              * we can parse.
0290              */
0291             done = true;
0292         } else {
0293             keys->is_first_frag = true;
0294             /* No need to parse fragmented packet unless
0295              * explicitly asked for.
0296              */
0297             if (!(keys->flags &
0298                   BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG))
0299                 done = true;
0300         }
0301     }
0302 
0303     if (done)
0304         return export_flow_keys(keys, BPF_OK);
0305 
0306     return parse_ip_proto(skb, iph->protocol);
0307 }
0308 
0309 PROG(IPV6)(struct __sk_buff *skb)
0310 {
0311     struct bpf_flow_keys *keys = skb->flow_keys;
0312     struct ipv6hdr *ip6h, _ip6h;
0313 
0314     ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
0315     if (!ip6h)
0316         return export_flow_keys(keys, BPF_DROP);
0317 
0318     keys->addr_proto = ETH_P_IPV6;
0319     memcpy(&keys->ipv6_src, &ip6h->saddr, 2*sizeof(ip6h->saddr));
0320 
0321     keys->thoff += sizeof(struct ipv6hdr);
0322     keys->ip_proto = ip6h->nexthdr;
0323     keys->flow_label = ip6_flowlabel(ip6h);
0324 
0325     if (keys->flags & BPF_FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL)
0326         return export_flow_keys(keys, BPF_OK);
0327 
0328     return parse_ipv6_proto(skb, ip6h->nexthdr);
0329 }
0330 
0331 PROG(IPV6OP)(struct __sk_buff *skb)
0332 {
0333     struct bpf_flow_keys *keys = skb->flow_keys;
0334     struct ipv6_opt_hdr *ip6h, _ip6h;
0335 
0336     ip6h = bpf_flow_dissect_get_header(skb, sizeof(*ip6h), &_ip6h);
0337     if (!ip6h)
0338         return export_flow_keys(keys, BPF_DROP);
0339 
0340     /* hlen is in 8-octets and does not include the first 8 bytes
0341      * of the header
0342      */
0343     keys->thoff += (1 + ip6h->hdrlen) << 3;
0344     keys->ip_proto = ip6h->nexthdr;
0345 
0346     return parse_ipv6_proto(skb, ip6h->nexthdr);
0347 }
0348 
0349 PROG(IPV6FR)(struct __sk_buff *skb)
0350 {
0351     struct bpf_flow_keys *keys = skb->flow_keys;
0352     struct frag_hdr *fragh, _fragh;
0353 
0354     fragh = bpf_flow_dissect_get_header(skb, sizeof(*fragh), &_fragh);
0355     if (!fragh)
0356         return export_flow_keys(keys, BPF_DROP);
0357 
0358     keys->thoff += sizeof(*fragh);
0359     keys->is_frag = true;
0360     keys->ip_proto = fragh->nexthdr;
0361 
0362     if (!(fragh->frag_off & bpf_htons(IP6_OFFSET))) {
0363         keys->is_first_frag = true;
0364 
0365         /* No need to parse fragmented packet unless
0366          * explicitly asked for.
0367          */
0368         if (!(keys->flags & BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG))
0369             return export_flow_keys(keys, BPF_OK);
0370     } else {
0371         return export_flow_keys(keys, BPF_OK);
0372     }
0373 
0374     return parse_ipv6_proto(skb, fragh->nexthdr);
0375 }
0376 
0377 PROG(MPLS)(struct __sk_buff *skb)
0378 {
0379     struct bpf_flow_keys *keys = skb->flow_keys;
0380     struct mpls_label *mpls, _mpls;
0381 
0382     mpls = bpf_flow_dissect_get_header(skb, sizeof(*mpls), &_mpls);
0383     if (!mpls)
0384         return export_flow_keys(keys, BPF_DROP);
0385 
0386     return export_flow_keys(keys, BPF_OK);
0387 }
0388 
0389 PROG(VLAN)(struct __sk_buff *skb)
0390 {
0391     struct bpf_flow_keys *keys = skb->flow_keys;
0392     struct vlan_hdr *vlan, _vlan;
0393 
0394     /* Account for double-tagging */
0395     if (keys->n_proto == bpf_htons(ETH_P_8021AD)) {
0396         vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
0397         if (!vlan)
0398             return export_flow_keys(keys, BPF_DROP);
0399 
0400         if (vlan->h_vlan_encapsulated_proto != bpf_htons(ETH_P_8021Q))
0401             return export_flow_keys(keys, BPF_DROP);
0402 
0403         keys->nhoff += sizeof(*vlan);
0404         keys->thoff += sizeof(*vlan);
0405     }
0406 
0407     vlan = bpf_flow_dissect_get_header(skb, sizeof(*vlan), &_vlan);
0408     if (!vlan)
0409         return export_flow_keys(keys, BPF_DROP);
0410 
0411     keys->nhoff += sizeof(*vlan);
0412     keys->thoff += sizeof(*vlan);
0413     /* Only allow 8021AD + 8021Q double tagging and no triple tagging.*/
0414     if (vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021AD) ||
0415         vlan->h_vlan_encapsulated_proto == bpf_htons(ETH_P_8021Q))
0416         return export_flow_keys(keys, BPF_DROP);
0417 
0418     keys->n_proto = vlan->h_vlan_encapsulated_proto;
0419     return parse_eth_proto(skb, vlan->h_vlan_encapsulated_proto);
0420 }
0421 
0422 char __license[] SEC("license") = "GPL";
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!